generated from coulomb/repo-seed
Bernd Worsch
95656f2324
Implements all 7 tasks from NK-WP-0005:
T01: creds-state.yaml → schema_version: 2, agent_mode: true
Replaces keepass_confirmed with emergency_bundle_delivered,
adds phase tracking fields for fully automated flow.
T02: creds-bootstrap-agent.sh — single entrypoint for autonomous
bootstrap. 10 phases, idempotent re-runs via state file.
Only human touchpoint: emergency bundle confirmation gate.
T03: emergency-bundle.sh — assembles and displays emergency bundle
(age key + break-glass passwords + ops bundle location).
Writes temp file, shreds on confirmation, clears screen.
Supports --reprint for re-delivery.
T04: ~/.claude/commands/creds-init.md — /creds-init skill replaces
/creds-bootstrap. Fully autonomous execution via the agent.
T05: Makefile — creds-agent-init, creds-agent-status,
creds-emergency-reprint targets.
T06: creds-rotate.sh — --non-interactive flag for agent-driven
rotation. Auto-confirms all gates; tracks last_rotated_<key>
in creds-state.yaml. LLDAP web UI step prints warning in
non-interactive mode.
T07: canon/standards/credential-management_v0.2.md — updated
standard: KeePassXC removed from operational path, agent
bootstrap as Phase 0, emergency bundle section, prohibited
patterns updated.
Also: creds-status.sh handles both schema v1 (legacy) and v2.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
33 lines
1.0 KiB
YAML
33 lines
1.0 KiB
YAML
# Credential state — net-kingdom SSO/MFA stack
|
|
# Safe to commit. Contains no secrets. Updated by agent.
|
|
# schema_version: 2 = agent-driven model (NK-WP-0005)
|
|
# schema_version: 1 = human-as-operator model (NK-WP-0004, now retired)
|
|
|
|
schema_version: 2
|
|
agent_mode: true # NK-WP-0005: fully automated
|
|
|
|
# Phase tracking
|
|
age_key_present: false # ~/.config/sops/age/keys.txt exists
|
|
secrets_generated: false # gen-secrets.sh ran successfully
|
|
ops_bundle_created: false # age-encrypted bundle created
|
|
ops_bundle_location: null # path or storage hint
|
|
|
|
# Emergency bundle
|
|
emergency_bundle_delivered: false # human confirmed receipt
|
|
emergency_bundle_delivered_at: null
|
|
|
|
# Cluster injection (per-component)
|
|
secrets_applied:
|
|
postgres: false
|
|
lldap: false
|
|
authelia: false
|
|
privacyidea: false
|
|
keycape: false
|
|
|
|
# Post-apply bootstrap (agent-run when pod is Ready)
|
|
enckey_bootstrapped: false
|
|
pi_admin_created: false
|
|
|
|
# Derived: all true → bootstrap complete
|
|
bootstrap_complete: false
|